Overview

overview

10

Static

static

3

JigsawRansomware.exe

windows7-x64

10

JigsawRansomware.exe

windows10-2004-x64

10

Resubmissions

19-05-2024 13:56

240519-q8s32sah73 10

11-05-2024 08:02

240511-jxchlafd8x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JigsawRansomware.exe

  • Size

    47KB

  • Sample

    240511-jxchlafd8x

  • MD5

    ed3a9817328547480076ef8e1e48bc0b

  • SHA1

    218a7b659078f07892d3e9a9905324b0eb95a5ba

  • SHA256

    0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

  • SHA512

    f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

  • SSDEEP

    768:BvqfRgrW3UJR/01V+FIpUY21RTjI4I17i6WrggpWxjW6msMev+JN5uMYqDYY:QfKrGUXyYFIpUYIpIRi7xyGsMev+JNwg

Score
10/10
jigsawpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      JigsawRansomware.exe

    • Size

      47KB

    • MD5

      ed3a9817328547480076ef8e1e48bc0b

    • SHA1

      218a7b659078f07892d3e9a9905324b0eb95a5ba

    • SHA256

      0e70bac97f8a8d4eda6347afe83c870b6f87f05f2fe3e7fb0bfcad7b29d0c5e5

    • SHA512

      f0e44829ac76c832bf67bd11193f9d3fb91e13f34110c6dd9f751dc79e2605811a99f149e942509d8dfbb7e461adb6d95735ff6fd378527ea4755fbf98034bf4

    • SSDEEP

      768:BvqfRgrW3UJR/01V+FIpUY21RTjI4I17i6WrggpWxjW6msMev+JN5uMYqDYY:QfKrGUXyYFIpUYIpIRi7xyGsMev+JNwg

    Score
    10/10
    jigsawpersistenceransomwarespywarestealer

    • Jigsaw Ransomware

      Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

      ransomwarejigsaw

    • Renames multiple (2014) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks